Child Data Protection Policy

Baby Flow is designed for parents and caregivers to track information about their babies. This Child Data Protection Policy explains how we collect, use, and protect data related to children in compliance with applicable laws including COPPA (Children's Online Privacy Protection Act) and GDPR.

We collect the following data about babies and children, provided by their parents or authorized caregivers:

• Baby's name and date of birth (or due date)
• Gender (optional)
• Feeding, sleep, diaper, and activity logs
• Growth measurements (weight, height, head circumference)
• Developmental milestones
• Health records (vaccinations, teething, food reactions)
• Photos uploaded by parents (optional)

By creating a baby profile, you confirm that you are the parent or legal guardian of the child, or have been authorized by the parent/legal guardian to use Baby Flow for that child. You consent to the collection and processing of your child's data as described in this policy and our Privacy Policy.

Child data is used exclusively to:

• Provide tracking and monitoring features
• Generate developmental insights and age-appropriate content
• Provide personalized AI recommendations (when enabled)
• Share with invited caregivers (at your direction)
• Generate reports for pediatrician visits

We do not use child data for advertising, profiling, or selling to third parties.

Child data is shared only:

• With caregivers you explicitly invite
• With AI providers (to generate insights) — data is processed in real-time and not stored by the provider
• When required by law

We never sell child data.

We implement industry-standard security measures to protect child data:

• Encryption in transit (TLS) and at rest
• Row-level security — only you and invited caregivers can access your child's data
• Regular security audits
• Strict access controls for our team

If you upload photos of your child, they are stored securely and only accessible to you and your invited caregivers. Photos are never shared publicly or used for any purpose other than displaying in your app.

You can grant caregivers access to specific data with customizable permissions (e.g., logging only, read-only). You can revoke access at any time, and all access is logged.

As a parent or guardian, you have the right to:

• Review all data collected about your child
• Correct inaccurate data
• Delete your child's data at any time
• Export your child's data
• Revoke caregiver access
• Withdraw consent for data processing

Child data is retained in accordance with our Data Retention Policy. When you delete a baby profile, all associated data is permanently removed within 30 days.

Questions about child data: privacy@babyflow.app